4.8 Anti-Rootkit / Anti-Spyware

[Chim]

I saw SOME Info on this on another thread, but am still not clear.  Since 4.8 came out, I was excited to see the addition of Anti-Rootkit & Anti-Spyware protection to avast!  Right from there, I understood, assumed that meant avast! was automatically incorporating that additional New protection to both the always on Real Time Scanning process and the On-Demand Manual Scans.  This without any User intervention / Setup required.  You know ... just let avast! do its thing and Fuhgedaboutit.  Now when I perused that other thread, I'm not sure if it's saying that the New Anti-Rootkit / Anti-Spyware aspect of avast! has to be done separately?

There were even some Commands mentioned in that thread for how to do the Anti-Rootkit / Anti-Spyware Scans.  It might have been the "Avast Software Inquiry" thread or something like that.

If I just leave avast! alone on the Real Time Scanning and if I run my On-Demand Manual Scans as normal as I did before with avast 4.7 ... IS my computer being checked for Rootkits & Spyware?  Without any extra Settings or Commands from me?  Why was it mentioned in that other thread that while both 4.8 Home & Pro provide this protection, it can only be configured and run in Pro?  Also, is this Anti-Rootkit / Anti-Spyware Protection even active on Windows 98SE, which is what I have?  Some weeks ago, in an E-mail from avast! Tech Support regarding my Web Shield inquiries, I was told that "the New Features" only work in Windows XP and above.  I don't know if that included the Anti-Rootkit / Anti-Spyware Protection.

[DavidR]

First the anti-rootkit feature doesn't work with win98, one of the disadvantages of retaining an older system, new features are unsupported by those OSes.

The anti-spyware is incorporated into the main scanning program and works even with win98. avast has for some time detected spyware, but only recently has been certofied/classed  as an anti-spyware as well as an anti-virus, this is seen in windows vista security center where avast is recognised as both an anti-spyware/virus application.

[Chim]

First the anti-rootkit feature doesn't work with win98, one of the disadvantages of retaining an older system, new features are unsupported by those OSes.

The anti-spyware is incorporated into the main scanning program and works even with win98. avast has for some time detected spyware, but only recently has been certofied/classed  as an anti-spyware as well as an anti-virus, this is seen in windows vista security center where avast is recognised as both an anti-spyware/virus application.

Alrighty, then.  Fair enough  No Rootkit Protection for my Flintstones Windows 98SE computer.  But, Hey, I can't complain.  As my friend who initially recommended avast! to me told me, "The Price is Nice!"  That is so true.  Can't beat the avast! price.  So, I'm Cool.  I'll just disguise myself from the Rootkits by wearing some Shades.     Thanks again, David!

[DavidR]

You're welcome.

[Chim]

First the anti-rootkit feature doesn't work with win98, one of the disadvantages of retaining an older system, new features are unsupported by those OSes.

The anti-spyware is incorporated into the main scanning program and works even with win98. avast has for some time detected spyware, but only recently has been certofied/classed  as an anti-spyware as well as an anti-virus, this is seen in windows vista security center where avast is recognised as both an anti-spyware/virus application.

I was reading up on this SUPERAntiSpyware that you use.  Do I understand correctly that its latest version checks for Rootkits?  Since avast! won't check my OLD Windows 98SE computer for Rootkits, would this SUPERAntiSpyware Rootkit Protection be equivalent to what avast! would provide?  Considering my computer system NOT having Star Trek Enterprise Warp Engines  ... would I be able to have this SUPERAntiSpyware in my computer without any slowdown?  Or how about this?  Can SUPERAntiSpyware be configured so that I could only do On-Demand Manual Scans instead of having it running in the background?  Is SUPERAntiSpyware better than Lavasoft Ad-Aware and Spybot: Search & Destroy, of which I used to use both years ago?  Can you elaborate whether the Updates for the FREE version of SUPERAntiSpyware are forever ... for an Unlimited time.  Or do they only last for a YEAR or some limited time?

Are the Findings of SUPERAntiSpyware Scans pretty much all legit or would I have to do some serious analyzing so as to NOT delete something important?  Like Registry Stuff is where I would have NO clue as to what is BAD and should be deleted ... or whether it was something important and a False Positive.

Do avast! and SUPERAntiSpyware play well --- work well with each other?
Uhhh, then again, if YOU are using it, I guess they DO, right?   

[DavidR]

1. Whilst SAS can be run on win98, I'm not sure if all of the features work in win98. I also don't know if the rootkit detections do the same as avast or if SAS is just scanning for known rootkit files used to install a rootkit.

I also don't know who effective a rootkit might be in playing on a win98 system.

2. The scans in SAS (legit is perhaps the wrong word) have generally been fine for me but I do know my way around a bit in these matters. You should get out of the habit of swearing, 'delete' you never delete always quarantine and investigate and never delete until you are absolutely sure it is malware.

There are things like tracking cookies that scare the living daylights out of people as they make a big deal about them when they really aren't. They are more of a privacy issue rather than a security issue and in the Preferences, Scanning Control I disable them and a number of other options (outside of the default settings), see image. I don't know if some of the options would be different with win98.

It knocks spots of adaware for sure and much better than S&B IMHO.

3. If they didn't play well together, you wouldn't see it in my signature

I suggest a visit to http://www.superantispyware.com/WebHelp/SUPERAntiSpyware.htm for some light reading.

[Chim]

1. Whilst SAS can be run on win98, I'm not sure if all of the features work in win98. I also don't know if the rootkit detections do the same as avast or if SAS is just scanning for known rootkit files used to install a rootkit.

I also don't know who effective a rootkit might be in playing on a win98 system.

2. The scans in SAS (legit is perhaps the wrong word) have generally been fine for me but I do know my way around a bit in these matters. You should get out of the habit of swearing, 'delete' you never delete always quarantine and investigate and never delete until you are absolutely sure it is malware.

There are things like tracking cookies that scare the living daylights out of people as they make a big deal about them when they really aren't. They are more of a privacy issue rather than a security issue and in the Preferences, Scanning Control I disable them and a number of other options (outside of the default settings), see image. I don't know if some of the options would be different with win98.

It knocks spots of adaware for sure and much better than S&B IMHO.

3. If they didn't play well together, you wouldn't see it in my signature

I suggest a visit to http://www.superantispyware.com/WebHelp/SUPERAntiSpyware.htm for some light reading.

I took a quick scan of the Info.  I'll read it in more detail a bit later.  But, in my brief preliminary speed read, I didn't really see any indications that something would NOT work on Windows 98SE.  I did see the differences between the FREE version and the Professional version, but I believe those differences were differences that would affect all versions of Windows if one downloaded the FREE version ... NOT just Windows 98SE.  Like some of the differences are No Registry Check in the FREE version and No Real-Time Scanning in the FREE version, among various other differences.  Well, that No Real-Time Scanning would actually sorta be what I wanted ... since I didn't want to risk it slowing down my system by running in the background.

So yeah, I'll read up more on it and who knows?  By this coming weekend, I'm bound to have it installed in my system.

As for your recommendation of thinking more in terms of "Quarantine" instead of "Delete?"  Actually, no argument there.  Back when I used to use McAfee, whenever McAfee gave me the option of "Cleaning" or "Repairing," I much rather preferred that.  It was only when those didn't work or they weren't an option, that I resorted to Delete.

But, Okay, I'll have to admit that on someone else's computer on which I did a lot of Tweaking & Maintenance a week ago ... after I uninstalled NOD32 AND AOL Safety & Security Center and Installed avast! ... avast! found 4 Win32:Virus Trojan-gen or something like that.  As I type this, those 4 Malware elements are still in the Virus Chest.  My original plan was to wait a week and if nothing was malfunctioning on the computer, I was going to delete those 4 Infected Files.  Now after reading stuff on this forum, I guess I'm going to change my plan to checking those 4 Infected Files on VirusScan Jotti and VirusTotal to see if they're not False Positives.

I'm gonna have to do the same with these 2 AIM Files that  ALWAYS get tagged by avast! on MY computer as being Adware-Gen.  The way I see it, that cannot be possible.  I've done immediate avast! Manual Scans straight fresh off of Total Windows Reinstalls ... and those SAME 2 AIM Files always get tagged by avast!  Those Files just came off of the AOL Installation CD, so they cannot possibly be Infected.  Unless they ARE technically Adware-Gen even though they come straight off of the AOL Installation CD.

Thanks again for your input / info / advice, David.  I'm finding a lot of good stuff here in this forum

[DavidR]

You're welcome.

The -gen bit in a malware name is an indication that it is using a generic signature this is trying to detect more than one variant of a type of malware with one signature, so there are likely to be times when you might get an FP.

So I would suggest you check the -gen detection at VirusTotal and if found to be an FP, then send samples to virus (at) avast dot com in a password protected zip attachment with the password in the body of the email. This is the only way to correct any FP or you could be continually getting pinged like in the AIM files you mention.